How to outsmart a Teenager

Ok. I had a computer brought to me a while back and was asked to install Net Nanny on the machine to prevent the teenage son from asking stuff he shouldn't.

Well the PC is once again in my office and wouldn't you know, the little bugger not only bypassed Net Nanny, but removed it from the system completely and gave himself admin rights. I have removed his rights and changed the passwords to the admin and parents account, and will reinstall Net Nanny shortly... Here's where it gets tricky...

I'm almost certain I know how he bypassed the system, and in order to prevent it from happening again, I need to remove the Run command from the start menu and disable the Registry for His account ONLY.
1. Can that be done?
2. How do I do it.

I know how to disable both globally, I need to do it for just one account on the system.
Also, anyone have any other savvy ideas on how to prevent him from regaining access? i.e. via Thumb/external drives, proxy sites, etc.

Thanks!

Forget about it. Are you going to disable the CDROM too? You didn't mention that. All he has to do is boot with a Live CD and all your policies in the registry are worthless. He can look at porn all day.

His parent(s) are going about it all wrong. Turning the PC into an etch-a-sketch won't work. If they were street wise themselves, they would be teaching him how to handle things and they wouldn't be trying to shelter him.

I agree completely Don, but it isn't my place to say anything about it. They are paying me to work on their PC not give parenting advice.

I'd like to think that he wouldn't know how to create a bootable CD or even know to look how to do it... Hopefully the mass deterrent will be enough.

Besides, After I've done all I can, I can wash my hands of the whole situation and not worry about it again.

The key to out-smarting a teenager, is letting them think they've won without making it too easy.

If administrative functions were setup to run through a virtual machine and changes were never "actually" applied until a hotkey or something was used, this kid would be scratching his head for awhile. If he's not, he's probably the one who should be administrating the system anyways. lol

Yes, while that would be very entertaining to watch. The customer would not pay for it.

Can what I'm asking be done?

I do all kinds of jobs for people, not just computers and I always tell the customer when he's wasting his money, even if it means that I don't get the job.

You're in that position now. The customer is wasting his money. I think you should be honest and tell them that because no matter what you do, their son will probably find a way around it.

I'm sure you're an honest business man and doing that would prove it.

All that being said, what you want to do requires registry changes to disable USB ports but I don't know if they can be done based on a profile or if the changes are global.

Joebert has a point about a virtual server type thing. I read something about using dyndns as an HTTP proxy and setting the filters there. I never tried it.

Here you go:

To remove the run command:


Once you remove the run command they cannot access the registry. You may want to take a look at something I wrote for disabling more stuff. You would also have to disable the task manager too since the wily teenager would be able to run regedit from there.

Grinch, don't forget, he wants to do it by profile since more than one person uses the PC and as I said, if he boots from a live CD, it's all for nothing. I wonder if the boy is reading our posts.

You could do it by profile but that is more tedious.

Kids are smart and will eventually figure out how to get around anything you put in place.

vista? i have not played with the setting much but the user account controls in visa can do a lot that net nanny can do.

The built-in parental controls in Vista are pretty good and not easy to get around. But i don't recommend moving to Vista just for that reason.

I agree with everything you guys are saying. Thanks for the tips. I will ask the user if this is really what she wants to do. But either way, just for S&G, how do I do it for a user only? I may not use it for this job, but it may come in handy someday.

Actually, my post above on the registry setting will affect only the user logged in. But you have to be logged in as that user in order to do it since you are messing with the current user registry settings.

Awesome. Thanks Grinch. You too Don!


BTW - Grinch... Nice site! LOL

how about lock the bios settings, order the boot sequence, and create a limited account with proper parental software?